How SSL Certificate History Can Help Threat Hunters Map Malicious Infrastructure
Summary
Historical SSL/TLS certificate data can help threat hunters connect domains and IPs, identify reused certificates and suspicious changes, and investigate infrastructure linked to malware and threat actors.
Key points
- Threat hunters can analyze certificate issuers, validity periods, and reuse across domains and IPs to find links to potentially malicious infrastructure.
- The article describes a Hunt.io investigation that used reused TLS certificates to connect KeyPlug command-and-control servers to infrastructure attributed to RedGolf/APT41.
- Historical certificate data may also reveal suspicious issuer-name patterns associated with malicious browser extensions.
- Monitoring certificate history can help identify unexpected changes on an organization's domains that may warrant investigation.
- OpenSSL can inspect current certificates, but the article notes it does not provide historical certificate data.
- The article demonstrates using Hunt.io's platform and HuntSQL to query certificate observations and pivot from certificates to associated IPs and hosts.
- Examples involving DarkPeony and Earth Baxia describe using certificate patterns and redirects to connect infrastructure associated with PlugX.
Article Details
- Defense Focus
- Use current and historical SSL/TLS certificate data to identify suspicious certificate changes, connect related infrastructure, and support threat hunting.
- Detection Methods
- Compare certificate issuers, validity periods, subject names, and reuse patterns across domains and IP addresses.
- Review certificate history for unexpected changes, replacements, or certificates appearing under altered but familiar-sounding issuer names.
- Pivot from a certificate to IP addresses and hostnames where it has been observed; correlate timestamps, ports, and associated domains.
- Monitor new SSL/TLS certificates and hostnames found on certificates.
- Data Sources
- Current and historical SSL/TLS certificate records, including issuers, validity periods, subject common names, and timestamps
- Certificate-to-IP and certificate-to-hostname observations
- IP address, port, and certificate activity history
- Rule Types
- HuntSQL queries
- Platforms
- Hunt.io Threat Hunting Platform
- Defensive Actions
- Monitor historical certificate data for unexpected changes on owned domains and investigate changes promptly.
- Pivot across IP addresses, hostnames, and domains that reuse a suspicious certificate to identify related infrastructure.
- Use certificate feeds to monitor newly observed certificates and hostnames.
- Investigate suspicious issuer names, certificate reuse, and associated ports and timestamps.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 47[.]121[.]120[.]18 | IP address that the article says is associated with AsyncRAT in certificate-history results. |
Threat Actors
APT41The article attributes the GhostWolf malicious infrastructure cluster to RedGolf/APT41.DarkPeonyNamed in connection with an investigation of SSL certificate patterns associated with PlugX command-and-control nodes and attacker infrastructure.Earth BaxiaThe article describes SSL certificate and redirect analysis identifying infrastructure linked to Earth Baxia's operations.RedGolfThe article attributes the GhostWolf malicious infrastructure cluster to RedGolf/APT41.
Malware
AsyncRATFind all IP and port combinations where a specific certificate value was observed. For example, searching for "AsyncRAT Server" in subject common names reveals all associated hosts and ports.KeyPlugTake, for example, Hunt.io's recent investigation into the KeyPlug malware. Our cyber threat hunting team uncovered an entire infrastructure of command-and-control (C2) servers by analyzing TLS certificates that werePlugXinvestigation, our research team identified recurring patterns in SSL certificates associated with PlugX command and control nodes. By analyzing these certificates, researchers connected seemingly unrelated